In this article 8 sections
ISO 27001 is the most-named, least-understood compliance framework in the MSP world. UK MSPs hear about it from prospects, from clients, from insurers, from peers, and most never read past the marketing.
What is ISO 27001 actually testing?
ISO 27001:2022 is an international standard for an Information Security Management System. The standard is published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). The “2022” is the latest version, released October 2022, replacing the 2013 version (with a transition deadline of October 2025).
The standard tests two things.
The Information Security Management System itself
That means the documented set of policies, processes, and review cycles your business uses to manage information security risk. Risk register, risk treatment plan, statement of applicability, internal audit programme, management review cadence, corrective action process. The ISMS is the management system. It’s the meta-layer that runs the controls.
93 Annex A controls
These are organised into 4 themes: organisational (37 controls), people (8), physical (14), and technological (34). Each control is a thing the standard expects you to either implement, partially implement, or formally exclude with justification. The Statement of Applicability is where you document which controls apply and how.
The 2022 update reduced the 2013 control list (114 controls) into the 4 simplified themes and added 11 new controls (mostly cloud, threat intelligence, secure development, data masking, ICT readiness for business continuity).
ISO 27001 is risk-based. There’s no fixed list of “you must have MFA.” The standard asks you to identify your risks and select controls that mitigate them. Annex A is the menu of available controls.
Who actually needs ISO 27001 if they’re an MSP?
Three categories of MSP.
Category 1: MSPs serving regulated or enterprise clients
If your client base includes financial services, healthcare, legal, government, or anything that procures via formal supplier risk frameworks, ISO 27001 is increasingly a hard requirement on tenders. Without it you don’t get past the procurement gate.
Category 2: MSPs preparing for sale or significant external investment
Due diligence on an MSP exit looks different now than 5 years ago. ISO 27001 is the cleanest way to demonstrate operational maturity to an acquirer. The cost of getting certified is small relative to the valuation impact at exit (most MSP brokers cite a 0.5x to 1.5x EBITDA multiple uplift for well-run, certified businesses).
Category 3: MSPs large enough for the Cyber Security and Resilience Bill
Medium and large UK MSPs come into scope as Relevant Managed Service Providers. NIS2 and DORA matter if you serve EU or financial services clients. As UK and EU regulation matures, ISO 27001 becomes the de facto baseline for “you’re serious.”
The MSPs who don’t need it yet: under £2m ARR, owner-led, mid-market commercial client base, no immediate exit plan. Cyber Essentials Plus is enough at that stage, and the operational return on ISO 27001 doesn’t yet justify the investment.
(The Assurix Trustmark sits next to ISO 27001 with a different design. It’s MSP-specific and faster to achieve, with live-measured controls checked every six hours and the rest on a set cycle. Many MSPs run both: Trustmark for live operational proof, ISO 27001 for procurement gates. They cover overlapping but distinct ground.)
How long does ISO 27001 actually take to get?
For most UK MSPs, 6 to 12 months end to end on a first attempt.
The common timeline:
- Months 1-2: Gap assessment against the 93 Annex A controls. Build the risk register. Draft the Statement of Applicability.
- Months 2-4: Write or update policies. Implement missing controls. Stand up the internal audit and management review cadence.
- Months 4-6: Run the ISMS for a quarter so the certification body can audit live operation, not just paperwork.
- Months 6-9: Stage 1 audit (documentation review). Then Stage 2 audit (operational review). Address any non-conformities.
- Months 9-12: Certificate issued. Surveillance audits annually for 2 years, then a full re-audit at year 3.
The MSPs that finish in 6 months are usually the ones who already have a strong evidence trail and good operational discipline. The MSPs that take 12+ months are usually trying to build the ISMS from scratch in parallel with running the business, with no dedicated owner.
The single biggest predictor of timeline is whether you assign a named ISMS owner with at least 30% of their week protected for it. Without that, ISO 27001 stretches.
What’s the difference between ISO 27001 and Cyber Essentials Plus?
Three differences that matter commercially.
Scope
CE+ is a narrow technical baseline of 5 controls (firewalls, malware, patching, access control, secure config). ISO 27001 covers all 93 Annex A control areas plus the management system around them. CE+ tests configuration. ISO 27001 tests configuration plus governance plus risk management plus continuous improvement.
Recognition
CE+ is UK-only and recognised mostly within UK government and UK supply chain procurement. ISO 27001 is international and recognised by insurers, multinationals, and procurement teams across the EU, US, and beyond.
Audit method
CE+ is a hands-on technical test. An assessor runs scans, reviews configs, validates 6 things over 1-2 days. ISO 27001 is a process audit. An auditor reviews documentation, interviews staff, samples evidence over 4-10 days depending on business size.
Cost and time
CE+ is roughly £1,500 to £3,500 per year and takes 6 to 12 weeks to achieve. ISO 27001 is roughly £8,000 to £25,000 per year (audit cost plus internal time) and takes 6 to 12 months on first pass.
The right answer is usually both. CE+ is the floor. You need it for any UK procurement gate that mentions cyber. ISO 27001 is the layer above. You get it when the client base or the regulatory scope demands it.
(The Assurix Trustmark is a third option, MSP-specific. Assurix independently assesses 59 controls: 40 security controls aligned to NCSC CAF 4.0 and 19 operational controls built for MSPs. An Assurix assessor signs off. Live-measured controls are checked every six hours and the rest on a set cycle. Both pillars must pass, so there’s no partial credit. Anyone can check the result. If a failure isn’t fixed within 30 days, the Trustmark is suspended publicly.)
How much does ISO 27001 cost an MSP?
Three cost layers.
Layer 1: Certification body fees
£4,000 to £15,000 per year depending on body and business size. UKAS-accredited bodies (Lloyd’s Register, BSI, DNV, NQA, etc.) cost more than non-accredited bodies, but the certificate is more credible. For most MSPs, UKAS-accredited is the right answer.
Layer 2: Internal time
200 to 600 hours over the first year, roughly half of that loaded onto whoever owns the ISMS. After year 1, ongoing internal time drops to roughly 100 to 200 hours per year.
For comparison, Assurix founder Mit Patel’s own MSP, Netstar, spent 180 hours and £28,000 on ISO 27001 in its first year.
Layer 3: Tooling and consultancy
Most MSPs use either a dedicated ISO consultant (£8,000 to £20,000 one-off) or a GRC platform (£5,000 to £15,000 per year). Some do it themselves on SharePoint, but the time cost climbs.
Total first-year cost for an MSP getting ISO 27001 from scratch: typically £20,000 to £50,000 fully loaded. Year 2 and onwards drops to £10,000 to £20,000 per year for ongoing maintenance.
The financial return shows up in 3 places: tender wins, supplier-risk pass-throughs, and (anecdotally) cyber insurance renewal pricing.
Should an MSP get ISO 27001 or the Trustmark first?
Depends entirely on the client base.
If the client mix skews towards UK-procurement-led, regulated, or enterprise organisations, ISO 27001 first. The procurement gate is harder, and ISO is the lingua franca.
If the client mix skews towards SME, mid-market, owner-managed, Trustmark first. The Trustmark is MSP-specific and signals operational maturity in a way SMEs actually understand. ISO 27001 carries less weight in that conversation.
If the answer is really “both,” Trustmark first because it’s faster (around 50 hours of work in total, from 2 hours a week, against 200 to 600 hours for ISO 27001) Evidence, policies and documents sit in one place, and they are reused for ISO 27001 where they overlap.
Choose the one your prospect will check.
Frequently asked questions
Is ISO 27001 a one-off cost or ongoing?
Ongoing. Annual surveillance audits and a full re-audit every 3 years. Plus internal time on the ISMS continuously.
Can I claim ISO 27001 readiness while pursuing certification?
Yes, but be specific. “We’re working towards ISO 27001 with target certification Q4 2026” is fair. “We’re ISO 27001 aligned” gives a prospect nothing to check, and most procurement teams will see through it.
Does ISO 27001 cover GDPR compliance?
Partially. ISO 27001 controls cover the security half of GDPR (data protection by design, breach response, supplier due diligence). It doesn’t cover the legal half (lawful basis, data subject rights, data protection impact assessments). You need both.
Can I drop CE+ once I have ISO 27001?
Generally no. UK government procurement still asks for CE+ specifically. Holding both costs around £2,000 a year extra and saves you the procurement headache.
What’s the certification body market like?
Concentrated. Lloyd’s Register, BSI, DNV, NQA, BAB, Bureau Veritas cover the bulk of UK MSP certifications. Get 3 quotes, ask about lead time on Stage 2 audits, check their prior MSP-vertical experience.
The closing principle
Pick the certification that matches the prospect in front of you, do the work properly, and treat the audit as a forcing function for operational discipline. Between audits, Assurix shows a prospect the current position, with live measures such as patching refreshed every six hours.
